A Command Injection flaw exists in the Linksys E5350 router firmware (v1.0.00.037). Manipulating the ping_ip or traceroute_ip parameters of the /wizard/apply.cgi endpoint allows an attacker to inject arbitrary operating‑system commands. Because the vulnerable code executes these strings without validation, an attacker can gain full control of the device, enabling arbitrary code execution, network pivoting, or firmware tampering.

The flaw affects the Linksys E5350 consumer router running firmware revision v1.0.00.037. No other firmware releases or models are currently known to be susceptible.

The CVSS score of 10 indicates critical severity. The vulnerability is publicly disclosed and the exploit is available, making it likely to be used by attackers. EPSS data is unavailable but the lack of a KEV listing does not mitigate the potential for exploitation, as the attack is remote via the web interface and requires only network connectivity to the device. The attacker need only craft a URL that includes the malformed ping_ip/traceroute_ip values to flow the command into the shell.